JP7026028B2 - Methods and systems for detecting attacks on cyber-physical systems using redundant devices and smart contracts - Google Patents

Description

Background This disclosure generally relates to the detection of attacks on cyber-physical systems. More specifically, the present disclosure relates to methods and systems for detecting attacks on cyber-physical systems using redundant devices and smart contracts.

Cyber-physical systems include physical and software / computer components in a network of physical input and output interaction elements rather than stand-alone devices. Cyber-physical systems include, for example, control systems and infrastructure for power grids, hydropower plants, building environment management systems, robotics systems, and aircraft systems. Attacks on cyber-physical systems may target physical processes by modifying the functionality of sensors, actuators, and control modules involved in the physical process. For example, an attacker could hack a gas pressure gauge in a power plant by physically increasing the amount of gas pumped into a particular cylinder, while at the same time cheating on the actual gauge readings to a normal level. It may be read as ("disguised"). This camouflage attachment prevents the plant operator or monitoring system from detecting the actual increased amount of gas, which can pose a safety issue.

Current methods for detecting such attacks rely on, for example, investigating telemetry originating from sensors and transmitting it to control stations. An alarm can be issued to the plant operator of the control station when a sensor reading that is out of a predetermined tolerance is detected, which may indicate the presence of a possible attack. However, as explained above, a clever attacker can modify the behavior of the sensor so that the telemetry emerging from the sensor mimics normal behavior, which allows the plant operator to potentially secure it. It can prevent you from detecting the above problem.

One approach to addressing the problem of detecting such attacks is to use redundant sensors. However, many of these redundant sensors still communicate with the plant operator over the same network, so an attacker hacking into the network can still disguise the redundant sensor. Even when using a redundant network, it generally involves communication with the plant operator. Therefore, this system can still be hacked against plant operators. This can have serious consequences for the entire cyber-physical system and control environment.

One embodiment facilitates the detection of attacks in cyber-physical systems of interacting elements with physical inputs and outputs. During operation, the system receives the first reading from the first set of sensors in the cyber-physical system via the first network by the first entity of the plurality of entities. The system receives the second indicated value from the second set of sensors of the cyber-physical system via the second network by the first entity, and the second network is any external entity, or Includes security measures that block access by any of multiple entities. The system executes a set of instructions based on the first instruction value and the second instruction value. The system determines that the result of the executed instruction does not match the expected state. The system takes corrective action based on the results.

In some embodiments, the first set of sensors is operating on the first network and the second set of sensors is a set of redundancy for the first set of sensors. A sensor, a second set of sensors, is operating on a second network, which is a redundant network for the first network. The first and second instructions represent the physical measurements used as inputs by the first entity when executing a set of instructions, and the result of the executed instructions is the blockchain. The output used to modify.

In some embodiments, the first and second instructors are received by other entities. A set of instructions is a smart contract, which is executed by another entity. Each entity of a plurality of entities operates on the blockchain. In response to determining the consensus of the results of the executed smart contract by a majority vote of multiple entities, the system writes the results to the blockchain.

In some embodiments, the system generates an unexpected state notification by a first entity or another entity that determines that the result of the executed smart contract does not match the expected state. Corrective action is taken by the first entity or another entity.

In some embodiments, the entities are distributed entities that communicate with each other.

In some embodiments, executing a set of instructions further involves computing a function based on the first and second instructions.

In some embodiments, each entity of the plurality of entities maintains a data structure having an entry, which entry is an identifier for each entity, a set of instructions executed by each entity. It contains one or more of a result, a time stamp associated with each entity executing the instruction, and an indicator of whether the result of the instruction executed by each entity matches the expected state.

In some embodiments, the expected state is to receive the first and second indications within a predetermined time interval, the first and second indications are equal. Whether or not the first and second indicated values are within a predetermined range, and whether the function performed based on the first and second indicated values is within the predetermined range. Whether it occurs, whether the first and second indications show the same physical quantity, whether the first and second readings show different physical quantities, and the first set of sensors. And based on one or more of device settings, firmware, or software changes associated with a second set of sensors.

It is a figure illustrating an exemplary environment for facilitating the detection of an attack in a cyber-physical system according to one embodiment of the present invention. It is a figure which illustrates the exemplary environment in the prior art. It is a figure which presents an exemplary distributed entity and an exemplary data structure according to an embodiment of the invention. It is a flowchart which illustrates the method by the distributed entity for facilitating the detection of the attack in the cyber-physical system according to one Embodiment of this invention. It is a flowchart which illustrates the method by the distributed entity for facilitating the detection of the attack in the cyber-physical system according to one Embodiment of this invention. It is a figure illustrating an exemplary distributed computer and communication system that facilitates the detection of attacks in a cyber-physical system according to an embodiment of the present invention.

In drawings, the same reference numbers refer to the same drawing elements.

The following description is presented to allow any person skilled in the art to create and use the present embodiment and is also provided in the context of a particular application and requirement. Various changes to the disclosed embodiments will be readily apparent to those of skill in the art, and the general principles defined herein do not deviate from the spirit and scope of the present disclosure. It may be applicable to other embodiments and applications. Accordingly, the invention is not limited to the embodiments shown, but should be given the broadest scope consistent with the principles and features disclosed herein.

Overview The embodiments of the present invention detect attacks on cyber-physical systems by using redundant sensors operating on redundant networks and by executing smart contracts between distributed entities based on blockchain technology. Address issues related to. Attacks on cyber-physical systems may target the physical processes of the interacting elements of the cyber-physical system. This attack may modify the functionality of sensors, actuators, and control modules involved in physical processes. Current methods for detecting such attacks rely on investigating the telemetry arising from the sensor and sending it to the control station. An alarm can be issued to the plant operator of the control station when a sensor reading that is out of a predetermined tolerance is detected, which may indicate the presence of a possible attack. However, a clever attacker can modify (eg, hack) the behavior of the sensor so that the telemetry emerging from the sensor mimics (eg, disguises) normal behavior, which the plant operator can do. , Prevents detection of potential safety issues.

One approach to the problem of detecting such attacks is to use redundant sensors. However, many of these redundant sensors still communicate with the plant operator over the same network, so an attacker hacking into the network can still disguise the redundant sensor. Even when using a redundant network, it generally involves communication with the plant operator. Therefore, this system can still be hacked against plant operators. This can have serious consequences for the entire cyber-physical system and control environment.

Embodiments of the present invention address this issue by providing a system with a set of primary sensors operating on a first network and a set of redundant sensors operating on a second network, The network contains security measures that block access by external entities. Primary and redundant sensors read and measure specific parameters of the physical process and send these readings to multiple stakeholders as well as the control station. These stakeholders may be an entity of a distributed processing system, which has several ways to communicate with other entities. For example, in the case of a nuclear power plant, stakeholders may include plant operators, local officials, federal organizations, and government or private oversight organizations.

Each stakeholder (or associated device) can include a processor operating in an authorized blockchain configuration. Blockchain can be a technical means of achieving a distributed consensus among parties that cannot trust each other. The blockchain allows each stakeholder to write data received from a device in the control system (eg, a sensor in a power plant). Blockchain also allows stakeholders to sign blocks, write data, and even encrypt data. Examples of data that can be written to the blockchain by interested parties are primary sensor readings and actuator actions at regular time intervals, redundant sensor readings at fixed time intervals, sensors, actuators, and Examples include controller module firmware upgrades, as well as instances where observed system behavior deviates from expected behavior, and how long the deviation occurs.

In addition, each stakeholder may execute a copy of the same smart contract, which copy is a program or set of instructions running on the blockchain. At a higher level, each stakeholder may receive a first reading from the primary sensor and a second reading from the redundant sensor via two separate networks. Each stakeholder can execute a smart contract by using the first instruction value and the second instruction value as inputs. For example, stakeholders can evaluate the mathematical functions of the first and second indicated values. Each stakeholder can then compare the results of the executed smart contract with the expected state. If the results do not match the expected conditions, stakeholders may take corrective action. This corrective action can vary by a number of variables, including stakeholder types, time intervals, given tolerances, history of previous similar results, and more.

Each stakeholder executes the same smart contract in the same way (ie, by executing the same set of instructions for the same input), so any single stakeholder determines a discrepancy. , Immediate corrective action can be taken. In addition, once a stakeholder majority vote reaches a consensus on the outcome, one of the entities can write the outcome to the blockchain.

Therefore, embodiments of the present invention provide a system that addresses issues involved in detecting attacks on cyber-physical systems, and the improvements are fundamentally technical. The system provides technical solutions to technical problems such as efficient detection of attacks on cyber-physical systems (eg, using redundant sensors operating on redundant networks, and blockchain-based distributed entities. (Using smart contracts between).

More specifically, blockchain-based consensus allows any single stakeholder to detect an attack. For example, if the plant operator fails to notice the attack in a reasonable amount of time, or if the plant operator is compromised in a way by the attack, any other stakeholder will enter the same input. Attacks can be detected by executing the same smart contract using. In addition, the redundant sensor operates on a redundant network that is not communicating with the control station. It can protect the system from most attacks against vulnerabilities in industrial control systems (eg SCADA systems). Finally, the redundant sensor provided an orthogonal view of the attack surface, thus causing the attacker to disguise the telemetry from the primary sensor and trick the control station into believing that the system was functioning properly. Attacks can be detected even in some cases.

Exemplary Networks and Communications Figure 1 illustrates an exemplary environment 100 for facilitating the detection of attacks in a cyber-physical system according to an embodiment of the invention. The environment 100 can include an industrial plant such as a power plant 120, including a cooling tower 122, a flue gas stack 124, and a reactor containment structure 126. The building 126 is physically measured by primary sensors 130.1 to 130.5 operating on the first network 102 and by redundant sensors 140.1 to 140.5 operating on the second network 104. The device can be included. The network 102 can be accessed, for example, by a plant operator, while the network 104 includes security measures that block access by either any external entity or any distributed entity (including the plant operator). Can be done.

Environment 100 also includes a plurality of distributed entities, namely device 154 associated with user 152, device 164 associated with user 162, device 174 associated with user 172, and device 184 associated with user 182. be able to. These entities can include multiple stakeholders who are interested in the operation of power plant 120. For example, user 152 can represent a plant operator, user 162 can represent a local agency, user 172 can represent a federal organization, and user 182 can represent a private monitoring agency. can. Each entity can have a processor that executes a set of instructions, eg smart contracts. That is, the device 154 can execute the smart contract 156, the device 164 can execute the smart contract 166, the device 174 can execute the smart contract 176, and the device 184 can execute the smart contract. 186 can be executed. Multiple distributed entities can communicate with each other either directly or through another distributed entity.

Environment 100 also exemplifies a cyber-physical system of physical inputs and interacting elements with outputs. For example, the equipment in the reactor containment building 126 interacts with distributed entities (eg, multiple stakeholders) via primary and redundant sensors. Cyber-physical systems use physical inputs of readings measured by sensors to produce the output of smart contracts executed by distributed entities.

During operation, the primary sensors 130.1 to 130.5 can acquire the indicated value and transmit the indicated value 132 as the first input 134 to a distributed entity such as the device 154 via the network 102. Simultaneously or nearly simultaneously, the redundancy sensors 140.1 to 140.5 acquire the redundancy indication (discussed in more detail below) and the indicator 154 via the network 104 with the indication 142 as the second input 144. Can be sent to. Note that the first and second inputs can be sent directly to each of the entities or to one or more of the entities. For example, as indicated by the dashed line, the first inputs (“F / I”) 135, 136, and 137 can also be transmitted via network 102 to devices 164, 174, and 184, respectively. , Second inputs (“S / I”) 145, 146, and 147 can also be transmitted to devices 164, 174, and 184, respectively, via network 104. Thus, the first and second inputs can be sent directly to each entity or to one or more of the entities via networks 102 and 104, respectively. In addition, the first and second inputs can be sent to the entity via the first receiving entity or any other distributed entity.

Each entity can then use the first and second inputs to perform a copy of its smart contract. Any entity that determines that the result of the executed smart contract does not match the expected state can take corrective action. For example, the device 154 may execute its smart contract 156 based on the first input 134 and the second input 144 and determine that the result of the executed smart contract 156 does not match the expected state. can. Device 154 (or user 152) can then take corrective action. These operations are described below with respect to FIGS. 4 and 5.

In addition, any entity can determine the consensus of the results of the executed smart contract and write the results to the blockchain by a majority vote of the other entity. Maintaining the data structure to determine consensus is described below with respect to FIG. 3, and writing the results to the blockchain is described below with respect to FIG.

In summary, the environment 100 includes a redundant sensor operating on a redundant network, and the plant operator is not communicating with the redundant network. Further, the environment 100 includes distributed entities (ie, multiple stakeholders), each receiving the same input (from primary and redundant sensors operating on different networks), each receiving the same. Execute the same smart contract for the received input. The distributed entity uses blockchain technology to reach consensus and write the agreed result to the blockchain so that any single entity can determine an unexpected situation and take immediate corrective action.

In contrast, FIG. 2 illustrates an exemplary environment 200 in the prior art. Similar to Environment 100, Environment 200 includes a reactor containment structure 126 having primary sensors 230.1 to 230.5 and redundant sensors 240.1 to 240.5. However, in contrast to Environment 100, these sensors are operating on the same network 202 and are communicating with the plant operator 242 and associated device 244 via the network 202. The malicious user 252 can initiate an attack 272 by spoofing data at point 260 or an attack 270 by spoofing data at point 262 via device 254, all at points 260 and 262. , Belonging to the same network communicating with the plant operator 242. Therefore, in the prior art environment 200 of FIG. 2, the cyber-physical system including the reactor containment building 126 is vulnerable to attack, unlike the embodiment described above with respect to the environment 100 of FIG.

Exemplary Distributed Entities and Data Structures FIG. 3 presents an exemplary distributed entities 300, as well as exemplary data structures 320 and 340, according to an embodiment of the invention. An exemplary distributed entity 300 can include a device 184 and an associated user 182. The device 184 can include a smart contract 186 and a data structure that holds the state of the smart contract and the state of consensus with respect to the result of the executed smart contract. For example, the exemplary data structure 320 can include entries 321, 322, 323, and 324, where each entry has an entity identifier (“Entity_ID”) 302 that identifies each entity, the same input (eg, f). (Input1, output2) = "<result_extracted>" or "<result_unexpected>", where "input1" corresponds to the indicated value from the primary sensor and "input2" corresponds to the indicated value from the redundant sensor. ), The result of the smart contract 304, which is the result of each entity executing the same smart contract, the time stamp 306 indicating the time the result was obtained or transmitted by each entity, and by each entity. Includes a state indicator 308 (eg, a flag indicating whether the state was "expected" or "unexpected"), whether the result of the executed smart contract matches the expected state. .. In some embodiments, the time stamp 306 can be a finite or repetitive duration, eg, a time window of 3 minutes from 09:06: 00 to 09:08:59.

Entries 321, 322, and 324 can indicate that the expected results were obtained by executing the smart contract for each entity, along with the corresponding timestamp. Entry 323 can be blank to indicate that it is holding data, i.e., device 174 has not yet executed a smart contract. Based on the data of entries 321, 322, and 324 of data structure 320, one of the related entities determines the consensus of the result by a majority vote of the entity (three of four in this case) and determines the result. Can be written to the blockchain. "Majority vote" can be defined as a weighted majority vote, more than half the number of entities, or any method that can be used to determine consensus.

An exemplary data structure 340 can include entries 341, 342, 343, and 344, which can produce unexpected results by running a smart contract with the corresponding timestamp for each entity. It can be shown that it was obtained. Entry 342 can be blank to indicate that it is holding data, i.e., device 164 has not yet executed a smart contract. As described above for the data structure 320, any of the related entities can determine the consensus of the results by a majority vote of the entities and write the results to the blockchain. In addition, any entity can take corrective action, including generating a notification to any of the other entities if it gets an unexpected result.

"Correctable action" includes repairing, replacing, or modifying a sensor, a physical object associated with the sensor, or any physical object or condition that may affect the sensor. Corrective actions also include actions that can thwart future attacks on cyber-physical systems, or actions associated with investigating the results of executed smart contracts that do not meet the expected conditions. Can be done. Each entity can take unique corrective actions that can depend on different parameters.

For example, an environmental observer may have determined that the mismatch between the primary sensor and the redundant sensor for a particular gas gauge exceeds a certain number of times within a particular time period (eg, more than 10 times over a 12 hour period). Corrective actions can be taken, such as notifying the plant (eg, sending a warning message or report) when it is out of range. In contrast, the plant operator finds similar discrepancies that differ from or shorter than the parameters for the environmental observer (eg, more than three times in a two hour period), the same primary and. Corrective actions can be taken, such as investigating redundant sensors (as well as corresponding physical and network elements).

Method for facilitating the detection of attacks in a cyber-physical system FIG. 4 is a flowchart 400 illustrating a method by distributed entities for facilitating the detection of attacks in a cyber-physical system according to an embodiment of the present invention. be. During operation, the system receives the first reading from the first set of sensors in the cyber-physical system via the first network by the first entity of the plurality of entities, the first. Sensor is operating on the first network (operation 402). The system receives the second indicated value from the second set of sensors of the cyber-physical system via the second network by the first entity, and the second set of the first sensor. A set of redundant sensors for, a second set of sensors operating on a second network, where the second network is either any external entity or any of a plurality of entities. Includes security measures to block access by (operation 404). The second network is a redundant network for the first network.

The system executes a set of instructions (eg, smart contract) based on the first instruction value and the second instruction value by the first entity (operation 406). The system receives the first instruction value and the second instruction value by another entity (operation 408). The system executes a smart contract by another entity based on the first and second instructions (operation 410), and the operation continues as described in label A of FIG.

FIG. 5 is a flowchart 500 illustrating a distributed entity method for facilitating the detection of attacks in a cyber-physical system according to an embodiment of the invention. During operation, the system determines the consensus of the results of the executed smart contract by a majority vote of the entities (determination 502). If the system has not determined consensus, the operation continues as described in operation 408 of FIG. If the system determines consensus, the system writes the result to the blockchain (operation 504). Results can be shown in the exemplary data structures 320 and 340 of FIG. 3 (eg, in the smart contract result field 304), as described above. Note that any of the distributed entities can determine consensus and write the results to the blockchain.

The system can also determine if the result of the executed smart contract matches the expected state (determination 512). The expected state is, for example, receiving the first and second readings within a predetermined interval, whether the first and second readings are equal, the first. Whether the indicated value and the second indicated value are within a predetermined range, whether the function performed based on the first indicated value and the second indicated value produces a result within the predetermined range, the first. Whether the indicated value and the second indicated value indicate the same physical quantity, whether the first indicated value and the second indicated value indicate different physical quantities, and whether the first sensor and the device associated with the second sensor are used. It can be based on settings, firmware, or software changes. As described above with respect to FIG. 3, an indicator of whether the expected conditions are met can be included in the state indicator field 308.

If the result matches the expected state (determination 512), the operation is undone. If the result does not match the expected state (determination 512), the system can optionally generate an unexpected state notification by a first entity or any entity that determines the unexpected state (behavior). 514). Determining an unexpected state means determining that the result of the executed smart contract does not match the expected state. The system can then take corrective action by any entity based on the unexpected condition (operation 516).

Exemplary Computers and Communication Systems FIG. 6 illustrates an exemplary distributed computer and communication system 602 that facilitates detection of attacks in a cyber-physical system according to an embodiment of the invention. The computer system 602 includes a processor 604, a memory 606, and a storage device 608. Memory 606 can include volatile memory (eg, RAM) that serves as managed memory and can also be used to store one or more memory pools. Further, the computer system 602 can be connected to the display device 610, the keyboard 612, and the pointing device 614. The storage device 608 can store the operating system 616, the content processing system 618, and the data 632.

The content processing system 618 can include instructions that, when executed by the computer system 602, can cause the computer system 602 to perform the methods and / or processes described in the present disclosure. Specifically, the content processing system 618 can include instructions for transmitting and / or receiving data packets to other network nodes through the computer network (communication module 620). The data packet can include data from a sensor, actuator, or controller module of the cyber-physical system, encrypted data, and a message indicating the indicated value.

The content processing system 618 is instructed by the first entity among the plurality of entities to receive the first instruction value from the first set of sensors of the cyber physical system via the first network. Can include (communication module 620). The content processing system 618 may include instructions for receiving a second instruction from a second set of sensors in the cyber-physical system via the second network by the first entity (communication). Module 620). The content processing system 618 can include instructions for executing a set of instructions based on the first instruction value and the second instruction value (smart contract execution module 622). The content processing system 618 can include an instruction for determining that the result of the executed instruction does not match the expected state (state determination module 624). The content processing system 618 can include an instruction to take corrective action based on the result (action execution module 630).

The content processing system 618 may include an instruction to write the result to the blockchain in response to determining the consensus of the result of the executed smart contract by a majority vote of multiple entities (consensus determination module 626). Yes (blockchain management module 628). The content processing system 618 can include an instruction for calculating a function based on a first instruction value and a second instruction value (smart contract execution module 622).

Data 632 can include any data required as input or produced as output by the methods and / or processes described in the present disclosure. Specifically, the data 632 contains at least an input, an instruction value, a physical measurement value or an instruction value indicating a physical input, an output, a smart contract, a set of instructions, a result of the executed smart contract, and a set of instructions. Execution results, network indicators, identifiers or indicators for sensors, blockchain, consensus indicators, notifications, expected states, corrective action indicators, functions, data structures, entries in data structures, identifiers for each entity. , The result of a set of instructions or smart contracts executed by each entity, the time stamp associated with each entity executing a set of instructions or smart contracts, the result of the executed instructions or smart contracts is expected Remembers indicators of whether a state matches, a given time interval, network security-related parameters, a given range, physical quantities, and device settings, firmware, or software changes associated with a set of sensors. be able to.

The data structures and codes described in this "mode for carrying out the invention" are typically stored in a computer-readable storage medium, which is the code and / or code for use by a computer system. It can be any device or medium that can store data. Computer-readable storage media include volatile and non-volatile memories, disk drives, magnetic tapes, CDs (compact discs), DVDs (digital versatile discs or digital video discs) and other magnetic and optical storage devices, or are currently known. Other, but not limited to, other media capable of storing computer-readable media that are or will be developed in the future.

The methods and processes described in the section "Modes for Carrying Out the Invention" can be embodied as codes and / or data that can be stored in a computer-readable storage medium as described above. When the computer system reads and executes the code and / or data stored in the computer readable storage medium, the computer system embodies the data structure and code and the method and stored in the computer readable storage medium. Run the process.

In addition, the methods and processes described above can be included in hardware modules or devices. Hardware modules or devices include application-specific integrated circuit (ASIC) chips, field programmable gate arrays (FPGAs), dedicated or shared processors that run parts of a particular software module or code at a particular time, and are currently known. Other programmable logic devices that have been or will be developed in the future, but are not limited to these. When you start a hardware module or device, it executes the methods and processes contained within them.

The above description of embodiments of the present invention are presented for purposes of illustration and illustration only. This description is not intended to be exhaustive or to limit the invention to the disclosed form. Therefore, many modifications and variations will be apparent to those skilled in the art. In addition, the above disclosure is not intended to limit the invention. The scope of the invention is defined by the appended claims.

Claims (10)

A method performed by a computer to facilitate the detection of attacks in cyber-physical systems of physical input and output interaction elements, said method.
Receiving a first indicated value from a first set of sensors in the cyber-physical system via a first network by a first device of a plurality of devices .
The first device receives a second indicated value from a second set of sensors in the cyber-physical system via the second network.
The first indicated value and the second indicated value measure the parameters of the same physical process.
The second set of sensors is different from the first set of sensors.
The second network includes security measures that block access by any external device , or any of the plurality of devices .
The first instruction value and the second instruction value receive a second instruction value received by another device among the plurality of devices .
To execute a set of instructions which is a smart contract based on the first instruction value and the second instruction value by the first device and the other device .
Does the result of the executed smart contract match the expected state based on the device settings, firmware, or software changes associated with the first set of sensors and the second set of sensors? Determining whether or not by the first device and the other device ,
Writing the results to the blockchain in response to determining the consensus of the results of the executed smart contract by a majority vote of the plurality of devices .
A method comprising, by at least one device , taking corrective action based on the result in response to determining that the result of the executed smart contract does not match the expected condition. The first set of sensors is operating on the first network, and the second set of sensors is a set of redundant sensors for the first set of sensors. , The second set of sensors is operating on the second network, which is a redundant network for the first network.
The first indicated value and the second indicated value indicate a physical measurement value used as an input by the first device when executing the set of instructions.
The method of claim 1, wherein the result of the executed instruction is an output used to modify the blockchain. The method according to claim 1, wherein each of the plurality of devices operates on the blockchain . A computer system for facilitating the detection of attacks in a cyber-physical system that interacts with physical inputs and outputs.
With the processor
The method comprises a storage device that stores instructions that cause the processor to perform a method when executed by the processor.
Receiving a first indicated value from a first set of sensors in the cyber-physical system via a first network by a first device of a plurality of devices .
The first device receives a second indicated value from a second set of sensors in the cyber-physical system via the second network.
The first indicated value and the second indicated value measure the parameters of the same physical process.
The second set of sensors is different from the first set of sensors.
The second network includes security measures that block access by any external device , or any of the plurality of devices .
The first instruction value and the second instruction value receive a second instruction value received by another device among the plurality of devices .
To execute a set of instructions which is a smart contract based on the first instruction value and the second instruction value by the first device and the other device .
Does the result of the executed smart contract match the expected state based on the device settings, firmware, or software changes associated with the first set of sensors and the second set of sensors? Determining whether or not by the first device and the other device ,
Writing the results to the blockchain in response to determining the consensus of the results of the executed smart contract by a majority vote of the plurality of devices .
A computer system comprising, by at least one device , taking corrective action based on the result in response to determining that the result of the executed smart contract does not match the expected state. .. The first set of sensors is operating on the first network, and the second set of sensors is a set of redundant sensors for the first set of sensors. , The second set of sensors is operating on the second network, which is a redundant network for the first network.
The first indicated value and the second indicated value indicate a physical measurement value used as an input by the first device when executing the set of instructions.
The computer system of claim 4, wherein the result of the executed instruction is an output used to modify the blockchain. The computer system according to claim 4, wherein each of the plurality of devices operates on the blockchain. A non-temporary computer-readable storage medium that stores instructions that, when executed by a computer, make the computer perform a method that facilitates the detection of attacks in cyber-physical systems of elements that interact with physical inputs and outputs. There, the above method is
Receiving a first indicated value from a first set of sensors in the cyber-physical system via a first network by a first device of a plurality of devices .
The first device receives a second indicated value from a second set of sensors in the cyber-physical system via the second network.
The first indicated value and the second indicated value measure the parameters of the same physical process.
The second set of sensors is different from the first set of sensors.
The second network includes security measures that block access by any external device , or any of the plurality of devices .
The first instruction value and the second instruction value receive a second instruction value received by another device among the plurality of devices .
To execute a set of instructions which is a smart contract based on the first instruction value and the second instruction value by the first device and the other device .
Does the result of the executed smart contract match the expected state based on the device settings, firmware, or software changes associated with the first set of sensors and the second set of sensors? Determining whether or not by the first device and the other device ,
Writing the results to the blockchain in response to determining the consensus of the results of the executed smart contract by a majority vote of the plurality of devices .
Non-temporary, including taking corrective action based on the result in response to the determination by the at least one device that the result of the executed smart contract does not match the expected state. Computer-readable storage medium. The first set of sensors is operating on the first network, and the second set of sensors is a set of redundant sensors for the first set of sensors. , The second set of sensors is operating on the second network, which is a redundant network for the first network.
The first indicated value and the second indicated value indicate a physical measurement value used as an input by the first device when executing the set of instructions.
The storage medium of claim 7, wherein the result of the executed instruction is an output used to modify the blockchain. The storage medium according to claim 7, wherein each of the plurality of devices operates on the blockchain . The expected state is
Receiving the first indicated value and the second indicated value within a predetermined time interval.
Whether the first indicated value and the second indicated value are equal.
Whether the first indicated value and the second indicated value are within a predetermined range.
Whether the function performed based on the first indicated value and the second indicated value produces a result within a predetermined range.
Whether the first indicated value and the second indicated value show the same physical quantity, and whether the first indicated value and the second indicated value show different physical quantities, one or more of them. The storage medium according to claim 7.

Images